Critical Linux TCP flaw CVE-2026-98432 leaves some distribution kernels unpatch…
A use-after-free bug in Linux's IPv4 TCP handshake code, rated 9.8 on CVSS, can be reached remotely without credentials. Several major distributions still lack a fix.
Source: Atlas
The flaw, tracked as CVE-2026-98432, affects Linux kernels from version 4.4 onward. It sits in code that handles incoming IPv4 TCP connections before any application sees them, and a remote peer can reach it without logging in. The kernel's own CVE Numbering Authority rates it 9.8 on CVSS 3.1. Upstream stable kernels received a fix in mid-October, a small change by Eric Dumazet that delays freeing memory until readers are finished with it.
Anthropic, the company whose researcher reported the bug, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on Linux servers with a multipath TCP listener, requiring no credentials. Go programs open such listeners by default since Go 1.24, according to the Go Security Team. Anthropic has not published the exploit.
Distribution kernels are the harder part. As of 5:15 PM CDT on October 31, Ubuntu's tracker still marked its kernels vulnerable, and Red Hat listed RHEL 8, 9, and 10 as affected with no fix yet. Debian, SUSE, Oracle, and Amazon Linux have released fixed kernels, while AlmaLinux's are in testing. Administrators should check their own distribution's tracker, since vendors use backported version numbers.
Until patches arrive, options include dropping incoming IPv4 TCP packets that carry IP options, using an nftables or iptables rule, or turning off multipath TCP where it is unused. Red Hat says its rule reduces exposure but cannot fully prevent the flaw, and these steps do not fix the kernel. A patched kernel only takes effect after a reboot.
